Re: Native pkcs#11 and auto-dnssec feature

2015-04-09 Thread Alan Clegg
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 4/9/15 2:58 AM, Catalin Leanca wrote: > "If the label contains a pin-source field, tools using the > generated key files will be able to use the HSM for signing and > other operations without any need for an operator to manually enter > a PIN." W

Re: Native pkcs#11 and auto-dnssec feature

2015-04-08 Thread Catalin Leanca
Problem solved. Manual helped: "If the label contains a pin-source field, tools using the generated key files will be able to use the HSM for signing and other operations without any need for an operator to manually enter a PIN." Thank you ! On 08/04/15 19:21, Catalin Leanca wrote: Hello, I

Re: Native pkcs#11 and auto-dnssec feature

2015-04-08 Thread Catalin Leanca
Hello, It helps only for dnssec-keyfromlabel tool that accepts "-l" parameter, but for dnssec-signzone i didn't find any reference. And the main problem is automatically internal signing with "auto-dnssec". On 08/04/15 18:21, Jeremy C. Reed wrote: My question is about auto-dnssec feature that

Re: Native pkcs#11 and auto-dnssec feature

2015-04-08 Thread Jeremy C. Reed
> My question is about auto-dnssec feature that maintain zone by > internally signing RRs. How this feature will work without a PIN since > BIND needs access to private key when it needs to resign automatically > and i did't find a way to provide the PIN throught configuration files > ? Hi, D